Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is an LDAP search filter; how is it read?
Short answer
An LDAP search filter is the expression that defines which objects in the directory match (RFC 4515). Each condition is written in parentheses in the (attribute=value) form; multiple conditions are combined with a prefix operator: (&(objectClass=user)(mail=*)) for AND, (|(uid=ali)(mail=ali@company.com)) for OR, (!(objectClass=computer)) for NOT. On its own, * means "every object that has the attribute", and inside a value it means "any text". When reading, the outer operator is read first, then the conditions inside it. In TR7 AGS, in an Authentication Provider of the LDAP type, for the user search, Search Filter Type is set to Custom and Custom Search Filter is written, the group search is done with Group Filter, and Bind Restriction Filter is used to limit login to a specific group. For management users, LDAP Bind Restriction Filter on the LDAP Settings screen is added with AND to the user search done under Base DN; if it is written without parentheses, the parentheses are added automatically.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (LDAP, Search and Bind) | Search Filter Type: Auto (default) / Custom; Custom Search Filter | Finding the user in the directory; the username is written with a Smart Variable, e.g. (sAMAccountName=%AGS_USER_INPUT(username)) |
| Same form (LDAP) | Group Filter (default (&(objectClass=group)(member=…)), with the user's DN) | Finding the groups the user is a member of |
| Same form (LDAP) | Bind Restriction Filter | Limiting login by combining it with the user search filter (e.g. (memberOf=CN=VPN Users,CN=Groups,DC=example,DC=com)) |
| Settings → User Management → LDAP Settings | LDAP Bind Restriction Filter | Limiting management login to a specific group; applied while Base DN is defined |
Operators
| Operator | Meaning | Example |
|---|---|---|
& | AND: all the conditions inside it | (&(objectClass=user)(department=IT)) |
| | OR: at least one of the conditions | (|(uid=ali)(mail=ali@company.com)) |
! | NOT: the opposite of the condition | (!(objectClass=computer)) |
=* | Every object that has the attribute | (mail=*) |
* (inside a value) | Any text | (cn=Ali*) |
>=, <= | Greater than or equal, less than or equal | (uidNumber>=1000) |
Nested example: (&(objectClass=user)(|(department=IT)(department=Security))(mail=*)) means "user objects that are in the IT or Security unit and have an e-mail address defined".
Common Misconceptions
- "The filter is written like SQL." In an LDAP filter, the operator comes before the conditions and each condition is in its own parentheses; words such as
ANDandORare not used. - "The group name is written in the filter with its short name." In attributes such as
memberOf, the full DN of the group is written (What are a DN (Distinguished Name) and a Base DN in LDAP?). - "The bind restriction filter limits management login on its own." In LDAP Settings, the filter is added to the user search done under Base DN; if Base DN is empty, this search is not done, so the filter is not applied either. For limiting with the filter, Base DN is also defined.
How it is done in the documentation
